CVE-2017-14519 — HIGH (7.5)

Vulnerability Description

In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opShowText, and Gfx::doShowText calls (aka a Gfx.cc infinite loop).

CVSS Score

7.5

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Freedesktop	Poppler	0.59.0

Related Weaknesses (CWE)

CWE-835

References

https://bugs.freedesktop.org/show_bug.cgi?id=102701ExploitThird Party Advisory
https://www.debian.org/security/2018/dsa-4079
https://bugs.freedesktop.org/show_bug.cgi?id=102701ExploitThird Party Advisory
https://www.debian.org/security/2018/dsa-4079

FAQ

What is CVE-2017-14519?

CVE-2017-14519 is a vulnerability with a CVSS score of 7.5 (HIGH). In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx::opShowText, and Gfx::doShowText calls (a...

How severe is CVE-2017-14519?

CVE-2017-14519 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-14519?

Check the references section above for vendor advisories and patch information. Affected products include: Freedesktop Poppler.